TrueCrypt, VeraCrypt(3.0+) が利用できるBSDライセンスc製の実装
2021-01-09時点でのDebian のパッケージはsidでもVerCryptに対応していないバージョン(1.1-6)
$ git clone https://github.com/bwalex/tc-play $ cd tc-play $ make -f Makefile.classic SYSTEM=linux $ ./tcplay -h usage: tcplay -c -d device [-g] [-z] [-w] [-a pbkdf_hash] [-b cipher] [-f keyfile_hidden] [-k keyfile] [-x pbkdf_hash] [-y cipher] tcplay -i -d device [-e] [-p] [-f keyfile_hidden] [-k keyfile] [-s system_device] [--fde] [--use-backup] [--use-hdr-file=hdr_file] [--use-hidden-hdr-file=hdr_file] tcplay -m mapping -d device [-e] [-p] [-f keyfile_hidden] [-k keyfile] [-s system_device] [--fde] [--use-backup] [--allow-trim] [--use-hdr-file=hdr_file] [--use-hidden-hdr-file=hdr_file] tcplay --modify -d device [-k keyfile] [--new-keyfile=keyfile] [--new-pbkdf-prf=pbkdf_hash] [-s system_device] [--fde] [--use-backup] [--save-hdr-to-file=hdr_file] [-w] [--use-hdr-file=hdr_file] [--use-hidden-hdr-file=hdr_file] tcplay --modify -d device [-k keyfile] --restore-from-backup-hdr [-w] tcplay -j mapping tcplay -u mapping tcplay -h | -v Valid commands are: -c, --create Creates a new TC volume on the device specified by -d or --device. -h, --help Print help message and exit. -i, --info Gives information about the TC volume specified by -d or --device. -j <mapping name>, --info-mapped=<mapping name> Gives information about the mapped TC volume under the given mapping. -m <mapping name>, --map=<mapping name> Creates a dm-crypt mapping with the given name for the device specified by -d or --device. -u <mapping name>, --unmap=<mapping name> Removes a dm-crypt mapping with the given name. --modify Changes the volume's passphrase, keyfile and optionally the hashing function used for the PBKDF password derivation. -v, --version Print version message and exit. Valid options for --create are: -a <pbkdf prf algorithm>, --pbkdf-prf=<pbkdf prf algorithm> Specifies which hashing function to use for the PBKDF password derivation when creating a new volume. To see valid options, specify '-a help'. -b <cipher>, --cipher=<cipher> Specifies which cipher to use when creating a new TC volume. To see valid options, specify '-b help'. -g, --hidden Specifies that the newly created volume will contain a hidden volume. -x <pbkdf prf algorithm>, --pbkdf-prf=<pbkdf prf algorithm> Specifies which hashing function to use for the PBKDF password derivation when creating a new hidden volume. By default, the same as for the outer volume will be used. To see valid options, specify '-x help'. -y <cipher>, --cipher=<cipher> Specifies which cipher to use when creating a new hidden volume. By default, the same as for the outer volume will be used. To see valid options, specify '-y help'. -z, --insecure-erase Skips the erase of the disk. Possible security hazard. -w, --weak-keys Uses a weak source of entropy (urandom) for key material. WARNING: This is a REALLY REALLY bad idea for anything but testing. Valid options for --modify are: --new-keyfile=<key file> Specifies a key file to use for the password derivation, when re-encrypting the header, can appear multiple times. --new-pbkdf-prf=<pbkdf prf algorithm> Specifies which hashing function to use for the PBKDF password derivation when re-encrypting the header. To see valid options, specify '-a help'. -s <disk path>, --system-encryption=<disk path> Specifies that the disk (e.g. /dev/da0) is using system encryption. --fde Specifies that the disk (e.g. /dev/da0) is using full disk encryption. --use-backup Uses the backup headers (at the end of the volume) instead of the primary headers. Both normal and backup headers will be modified! This is useful when your primary headers have been corrupted. --use-hdr-file=<header file> Use the header in the specified file instead of the main header on the disk as source for the modify operation. --use-hidden-hdr-file=<header file> Use the header in the specified file instead of the hidden header on the disk as source for the modify operation. --restore-from-backup-hdr Implies --use-backup, no new PBKDF hashing function, no new keyfiles and no new passphrase. In other words, this will simply restore both headers from the backup header. This option cannot be used to restore from a backup header file. -w, --weak-keys Uses a weak source of entropy (urandom) for salt material. The key material is not affected, as the master keys are kept intact. WARNING: This is a bad idea for anything but testing. --save-hdr-backup=<header file> Saves the modified header in the specified file instead of updating the header files on disk. Valid options for --info and --map are: -e, --protect-hidden Protect a hidden volume when mounting the outer volume. -p, --prompt-passphrase Immediately prompt for a passphrase even if a keyfile is supplied. -s <disk path>, --system-encryption=<disk path> Specifies that the disk (e.g. /dev/da0) is using system encryption. -t, --allow-trim Allow discards (TRIM command) on mapped volume. --fde Specifies that the disk (e.g. /dev/da0) is using full disk encryption. --use-backup Uses the backup headers (at the end of the volume) instead of the primary headers. This is useful when your primary headers have been corrupted. --use-hdr-file=<header file> Use the header in the specified file instead of the main header on the disk. --use-hidden-hdr-file=<header file> Use the header in the specified file instead of the hidden header on the disk. Valid options common to all commands are: -d <device path>, --device=<device path> Specifies the path to the volume to operate on (e.g. /dev/da0s1). -f <key file>, --keyfile-hidden=<key file> Specifies a key file to use for the hidden volume password derivation. This option is only valid in combination with -e, --protect-hidden or -g, --hidden. -k <key file>, --keyfile=<key file> Specifies a key file to use for the password derivation, can appear multiple times.
コメント